Faster Response Means Lower Costs

Speed may be the missing ingredient in minimizing damage from cyberattacks.

When responding to an emergency, speed matters. It's true in traffic incidents and structure fires, and it's true in the realm of computers and networks. There's no real surprise here, but a new report by the Aberdeen Group has quantified just how much speed matters -- and it turns out to matter quite a lot.

One of the things that the study (sponsored by McAfee) looked at was dwell time, or the time between breach and detection. Put another way, the dwell time is just how long the attacker was able to run free inside a system before being detected. The median time to detect in the attacks studied by Aberdeen (which were taken, in turn, from the Verizon Data Breach Investigations Report) was 38 days. That means half were detected in less that five weeks, while the other half took up to four years to be detected.

The report broke the attacks into two broad categories: those intended to steal information and those intended to disrupt service. Aberdeen found that the impact of response time differed greatly between the two types of attacks. In attacks designed to steal confidential data, detection and response twice as fast meant a reduction in business impact of 30%. In those attacks intended to disrupt service, detection and response twice as fast meant that business impact was reduced by 70%.

In a Security Now telephone interview with Barbara Kay, McAfee's senior director of product and solutions marketing, she pointed out that information like this can be important for an IT staff, especially when it comes to budget discussions. "You have people in IT trying to justify expenditures and this data set says that reducing time to detect and time to respond both make a tangible difference in impact. Investing in detection and response does have a tangible impact," Kay said. "This is a sound business decision."

Kay pointed out that knowing the importance of response time could have an impact on a less-easily measured IT factor, as well. "It makes staff know that their time matters," she said. "Showing the staff that their time matters and that they have an impact makes a difference in an overworked staff."

Longer response times were generally (though not always) attached to zero-day attacks -- attacks in which the first public knowledge of a vulnerability comes when it is used in a successful attack. In cases where the vulnerability is known and corrected before an attack is launched -- as with the recent WannaCry attack -- attention turns to whether the patch has been applied and the legitimacy of reasons for not patching the issue.

Aberdeen estimates that an enterprise will deal with between 220 and 660 vendor patches a year. That translates to a median of 910 hours a year in disruption to enterprise applications. Given that "five nines" reliability is seen as standard reliability in many organizations (a metric that, by the way, means 26 seconds per year in downtime), 910 hours is completely unacceptable. So what options are available to organizations that want to stay on top of the situation?

A solid patch-management regimen is at the top of the list. Next up is virtual patching -- sometimes known as external patching or vulnerability shielding -- to deal with the vulnerabilities before the system can be patched. In virtual patching, an attack based on a vulnerability is understood and a blocking rule is applied by a firewall, filter or UTM to prevent the exploit from ever reaching the vulnerable system. This can be an effective protective mechanism while waiting for patches to be applied.

So get faster. Much faster. It's the responsible thing to do in security.

— Curtis Franklin is the editor of Follow him on Twitter @kg4gwa.

Read more about:

Security Now

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights